Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Trust surface V-009
Finds roles that outside accounts, any principal or unbound web identities can assume, and changes to who may assume a role.
Checks
| Checks | Needs |
|---|---|
| Finds role trust to an account outside your organization. | iam role |
| Finds third-party role trust without an external id condition. | iam role |
| Finds role trust that admits any principal. | iam role |
| Finds role trust left pointing at a deleted principal. | iam role |
| Finds web-identity trust without a subject or audience condition. | iam role, iam oidc provider |
| Says when the identity provider behind a web-identity trust could not be read. | iam role, iam oidc provider |
| Finds web-identity trust with a wildcard subject. | iam role, iam oidc provider |
| Finds identity providers that match no cluster issuer. | iam oidc provider, eks cluster |
| Finds Pod Identity associations on a default service account. | eks pod identity assoc |
| Finds Pod Identity associations added or changed since the last run. | eks pod identity assoc |
| Notes Pod Identity associations that Warden itself installs being added or changed. | eks pod identity assoc |
| Finds Pod Identity trust without tag or source conditions. | iam role |
| Says when a role's trust document could not be read. | iam role |
| Catches trust policies updated, and identity providers or associations created. | Live events: trust |
Coverage
Read everywhere
| global | ‹payments-prod-cluster› | |
|---|---|---|
‹prod-acct› 123456789012 | Read | Read |
Run history
No run has recorded this rule yet.
Findings
12 open findings See them grouped
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
GetOpenIDConnectProvider / role trust document vs live EKS issuers and the org account list → remove or condition the trust by IaC; reversible